@novacraft-engineering/pulsar-cli 1.1.1 → 1.2.1

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novacraft-engineering/pulsar-cli",
-  "version": "1.1.1",
-  "description": "Pulsar OTA release CLI — bundle, hash, and ship React Native updates over-the-air.",
+  "version": "1.2.1",
+  "description": "Pulsar OTA release CLI \u2014 bundle, hash, and ship React Native updates over-the-air.",
   "type": "module",
   "bin": {
     "pulsar": "./pulsar.js"
@@ -26,7 +26,7 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node test/hash.test.js"
+    "test": "node test/hash.test.js && node test/security.test.js"
   },
   "keywords": [
     "react-native",

package/pulsar.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import readline from 'node:readline';
+import http from 'node:http';
 import {execFileSync} from 'node:child_process';
 import crypto from 'node:crypto';
 import {computePackageHash, fileHashes} from './hash.js';
@@ -22,7 +23,7 @@ function cmdKeygen() {
     publicKeyEncoding: {type: 'spki', format: 'pem'},
     privateKeyEncoding: {type: 'pkcs8', format: 'pem'},
   });
-  fs.writeFileSync('pulsar-private.pem', privateKey);
+  fs.writeFileSync('pulsar-private.pem', privateKey, {mode: 0o600});
   fs.writeFileSync('pulsar-public.pem', publicKey);
   console.log('✓ wrote pulsar-private.pem (keep secret, use with --private-key) and pulsar-public.pem');
   console.log('  Put the public key in Info.plist <key>CodePushPublicKey</key> to require signed updates.');
@@ -40,17 +41,20 @@ function loadConfig() {
 }
 
 function saveConfig(config) {
-  fs.mkdirSync(CONFIG_DIR, {recursive: true});
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2));
+  // The config holds a bearer token — keep the dir and file owner-only so other local users on a
+  // shared host can't read the session.
+  fs.mkdirSync(CONFIG_DIR, {recursive: true, mode: 0o700});
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), {mode: 0o600});
+  try { fs.chmodSync(CONFIG_FILE, 0o600); } catch { /* best-effort on pre-existing files */ }
 }
 
-async function api(pathname, {method = 'GET', body, headers = {}, raw, allowAnonymous} = {}) {
+async function api(pathname, {method = 'GET', body, headers = {}, raw, allowAnonymous, onUploadProgress} = {}) {
   const {apiUrl, token} = loadConfig();
   if (!apiUrl) die('No API url. Run: pulsar login <apiUrl>');
   // Every call except the login handshake must carry a token, so an expired or
   // cleared session fails here rather than silently issuing anonymous requests.
   if (!token && !allowAnonymous) die('Not authenticated. Run: pulsar login <apiUrl>');
-  const response = await fetch(apiUrl.replace(/\/$/, '') + pathname, {
+  const options = {
     method,
     headers: {
       ...(token ? {authorization: `Bearer ${token}`} : {}),
@@ -58,7 +62,24 @@ async function api(pathname, {method = 'GET', body, headers = {}, raw, allowAnon
       ...headers,
     },
     body: raw ? body : body ? JSON.stringify(body) : undefined,
-  });
+  };
+  // Stream a raw upload in chunks so we can report progress as the request drains to the socket.
+  if (raw && onUploadProgress && body && body.length) {
+    const total = body.length;
+    let offset = 0;
+    const chunkSize = 64 * 1024;
+    options.body = new ReadableStream({
+      pull(controller) {
+        if (offset >= total) { controller.close(); return; }
+        const end = Math.min(offset + chunkSize, total);
+        controller.enqueue(body.subarray(offset, end));
+        offset = end;
+        onUploadProgress(offset, total);
+      },
+    });
+    options.duplex = 'half';
+  }
+  const response = await fetch(apiUrl.replace(/\/$/, '') + pathname, options);
   const text = await response.text();
   // Check the status BEFORE parsing: an edge/proxy error (413, 502, 524) returns
   // an HTML page, and parsing that first turned every such failure into an
@@ -99,11 +120,81 @@ function prompt(question, hidden = false) {
   });
 }
 
-async function resolveApp(nameOrId) {
+// Returns an onUploadProgress callback that renders a single updating line (or plain lines in CI).
+function uploadProgress(label) {
+  let lastPct = -1;
+  return (sent, total) => {
+    const pct = Math.floor((sent / total) * 100);
+    if (pct === lastPct && sent < total) return;
+    lastPct = pct;
+    const line = `• ${label} — ${pct}% (${(sent / 1e6).toFixed(1)}/${(total / 1e6).toFixed(1)} MB)`;
+    if (process.stdout.isTTY) {
+      process.stdout.write(`\r${line}   `);
+      if (sent >= total) process.stdout.write('\n');
+    } else if (sent >= total) {
+      console.log(line);
+    }
+  };
+}
+
+function openBrowser(url) {
+  try {
+    if (process.platform === 'darwin') execFileSync('open', [url], {stdio: 'ignore'});
+    else if (process.platform === 'win32') execFileSync('cmd', ['/c', 'start', '', url], {stdio: 'ignore'});
+    else execFileSync('xdg-open', [url], {stdio: 'ignore'});
+  } catch { /* the URL is printed too, so the user can open it manually */ }
+}
+
+function dashboardUrl(apiUrl) {
+  try {
+    const parsed = new URL(apiUrl);
+    parsed.host = parsed.host.replace(/^api\./, '');
+    return `${parsed.protocol}//${parsed.host}`;
+  } catch { return apiUrl.replace(/\/$/, ''); }
+}
+
+// Browser login: spin up a throwaway localhost server, open the dashboard's /cli-login page which
+// (once you're signed in) redirects back here with a token. No password ever touches the terminal.
+function browserLogin(apiUrl) {
+  // A random nonce ties the callback to THIS login: the dashboard echoes it back and we reject any
+  // callback whose state doesn't match, so a stray page spraying the loopback port range can't inject
+  // its own token into our config (login fixation).
+  const state = crypto.randomUUID();
+  return new Promise((resolve, reject) => {
+    const server = http.createServer((req, res) => {
+      const requestUrl = new URL(req.url, 'http://127.0.0.1');
+      if (requestUrl.pathname !== '/callback') { res.writeHead(204); res.end(); return; }
+      const token = requestUrl.searchParams.get('token');
+      const ok = token && requestUrl.searchParams.get('state') === state;
+      res.writeHead(ok ? 200 : 400, {'content-type': 'text/html'});
+      res.end(`<!doctype html><meta charset="utf-8"><body style="font-family:system-ui;background:#080a0f;color:#eef2f7;display:grid;place-items:center;height:100vh;margin:0"><div style="text-align:center"><h2 style="font-weight:600">${ok ? 'Pulsar CLI authorized ✓' : 'Authorization failed'}</h2><p style="color:#8f98a6">You can close this tab and return to your terminal.</p></div></body>`);
+      if (!ok) return;
+      setTimeout(() => { try { server.close(); } catch {} }, 100);
+      resolve(token);
+    });
+    server.on('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      const {port} = server.address();
+      const authUrl = `${dashboardUrl(apiUrl)}/cli-login?port=${port}&state=${state}`;
+      console.log(`\n  Authorize the CLI in your browser:\n  ${authUrl}\n`);
+      openBrowser(authUrl);
+      console.log('  Waiting for authorization…');
+    });
+    setTimeout(() => { try { server.close(); } catch {} reject(new Error('Login timed out after 3 minutes')); }, 180000);
+  });
+}
+
+async function resolveApp(nameOrId, platform) {
   const apps = await api('/apps');
-  const match = apps.find((app) => app.id === nameOrId || app.name === nameOrId);
-  if (!match) die(`App not found: ${nameOrId}. Known: ${apps.map((app) => app.name).join(', ') || '(none)'}`);
-  return match;
+  const byId = apps.find((app) => app.id === nameOrId);
+  if (byId) return byId;
+  const named = apps.filter((app) => app.name === nameOrId);
+  if (!named.length) die(`App not found: ${nameOrId}. Known: ${apps.map((app) => `${app.name} [${app.os}]`).join(', ') || '(none)'}`);
+  if (named.length === 1) return named[0];
+  // Same name for an iOS and an Android app — disambiguate by platform (or the app id).
+  const forPlatform = platform && named.find((app) => app.os === platform);
+  if (forPlatform) return forPlatform;
+  die(`Multiple apps named "${nameOrId}" (${named.map((app) => app.os).join(', ')}). Pass --platform ios|android, or use the app id.`);
 }
 
 function bundle(platform, contentsDir) {
@@ -173,9 +264,26 @@ function getFlag(args, name, fallback) {
 
 async function cmdLogin(args) {
   const apiUrl = args[0] || (await prompt('API url: '));
+  saveConfig({apiUrl, token: undefined});
+
+  let mode;
+  if (args.includes('--browser')) mode = 'browser';
+  else if (args.includes('--terminal')) mode = 'terminal';
+  else {
+    const answer = (await prompt('Sign in with [b]rowser or [t]erminal? (b/t): ')).toLowerCase();
+    mode = answer.startsWith('t') ? 'terminal' : 'browser';
+  }
+
+  if (mode === 'browser') {
+    const token = await browserLogin(apiUrl);
+    saveConfig({apiUrl, token});
+    const me = await api('/auth/me').catch(() => null);
+    console.log(`✓ logged in${me?.email ? ` as ${me.email}` : ''} (browser)`);
+    return;
+  }
+
   const email = await prompt('Email: ');
   const password = await prompt('Password: ', true);
-  saveConfig({apiUrl, token: undefined});
   const {token, user} = await api('/auth/login', {method: 'POST', body: {email, password}, allowAnonymous: true});
   saveConfig({apiUrl, token});
   console.log(`✓ logged in as ${user.email} (${user.platformRole})`);
@@ -207,6 +315,7 @@ async function pushBuiltRelease(app, deployment, args, contentsDir, packageHash,
     method: 'POST',
     raw: true,
     body: zip,
+    onUploadProgress: uploadProgress(`uploading ${(zip.length / 1e6).toFixed(1)}MB bundle`),
     headers: {
       'content-type': 'application/zip',
       'x-app-version': getFlag(args, 'target'),
@@ -231,6 +340,7 @@ async function pushBuiltRelease(app, deployment, args, contentsDir, packageHash,
         method: 'POST',
         raw: true,
         body: diffZip,
+        onUploadProgress: uploadProgress(`uploading ${(diffZip.length / 1e6).toFixed(1)}MB diff`),
         headers: {'content-type': 'application/zip', 'x-base-hash': prevLatest.packageHash},
       });
       const saved = Math.round((1 - diffZip.length / zip.length) * 100);
@@ -262,7 +372,10 @@ async function cmdRelease(args) {
   const [nameOrId, deployment = 'Staging'] = args;
   if (!nameOrId) die('Usage: pulsar release <app> <Staging|Production> --platform ios|android --target <ver> [--mandatory] [--disabled] [--rollout N] [--devices id1,id2,...] [--private-key key.pem] [--no-diff] [--description "..."]');
   if (!getFlag(args, 'target')) die('--target <binary version> is required (e.g. --target 1.0.0)');
-  const app = await resolveApp(nameOrId);
+  const app = await resolveApp(nameOrId, getFlag(args, 'platform', 'ios'));
+  if (app.os !== getFlag(args, 'platform', 'ios')) {
+    console.log(`• note: resolved app "${app.name}" is ${app.os}; bundling ${getFlag(args, 'platform', 'ios')}`);
+  }
   const {contentsDir, packageHash, zip} = buildOnce(args);
   await pushBuiltRelease(app, deployment, args, contentsDir, packageHash, zip);
 }
@@ -302,7 +415,7 @@ async function cmdReleaseTrain(args) {
 
 async function cmdPromote(args) {
   const [nameOrId, from = 'Staging', to = 'Production'] = args;
-  const app = await resolveApp(nameOrId);
+  const app = await resolveApp(nameOrId, getFlag(args, 'platform'));
   const release = await api(`/apps/${app.id}/deployments/${from}/promote`, {
     method: 'POST',
     body: {to, rollout: Number(getFlag(args, 'rollout', '100'))},
@@ -312,14 +425,14 @@ async function cmdPromote(args) {
 
 async function cmdRollback(args) {
   const [nameOrId, deployment = 'Production'] = args;
-  const app = await resolveApp(nameOrId);
+  const app = await resolveApp(nameOrId, getFlag(args, 'platform'));
   const release = await api(`/apps/${app.id}/deployments/${deployment}/rollback`, {method: 'POST'});
   console.log(`✓ rolled back ${app.name}/${deployment} → ${release.label}`);
 }
 
 async function cmdDeployment(args) {
   const [sub, nameOrId, depName] = args;
-  const app = await resolveApp(nameOrId);
+  const app = await resolveApp(nameOrId, getFlag(args, 'platform'));
   if (sub === 'add') {
     if (!depName) die('Usage: pulsar deployment add <app> <name>');
     const created = await api(`/apps/${app.id}/deployments`, {method: 'POST', body: {name: depName}});
@@ -336,7 +449,7 @@ async function cmdDeployment(args) {
 
 async function cmdHistory(args) {
   const [nameOrId, deployment = 'Staging'] = args;
-  const app = await resolveApp(nameOrId);
+  const app = await resolveApp(nameOrId, getFlag(args, 'platform'));
   const releases = await api(`/apps/${app.id}/deployments/${deployment}/releases`);
   if (!releases.length) return console.log('(no releases)');
   for (const release of [...releases].reverse()) {
@@ -348,7 +461,7 @@ async function cmdHistory(args) {
 async function cmdPatch(args) {
   const [nameOrId, deployment, label] = args;
   if (!label) die('Usage: pulsar patch <app> <deployment> <label> [--rollout N] [--mandatory] [--disable] [--enable] [--devices id1,id2,...]');
-  const app = await resolveApp(nameOrId);
+  const app = await resolveApp(nameOrId, getFlag(args, 'platform'));
   const body = {};
   const rollout = getFlag(args, 'rollout');
   if (rollout !== undefined) body.rollout = Number(rollout);
@@ -408,28 +521,33 @@ async function cmdKeys(args) {
   console.log(`✓ wrote ${Object.keys(vars).length} key(s) to ${target} (${written.size} updated, ${missing.length} added)`);
 }
 
-const [command, ...rest] = process.argv.slice(2);
-const commands = {
-  login: cmdLogin,
-  apps: cmdApps,
-  release: cmdRelease,
-  'release-train': cmdReleaseTrain,
-  promote: cmdPromote,
-  rollback: cmdRollback,
-  deployment: cmdDeployment,
-  history: cmdHistory,
-  patch: cmdPatch,
-  keygen: cmdKeygen,
-  keys: cmdKeys,
-};
-
-const ANONYMOUS_COMMANDS = new Set(['login', 'keygen']);
-
-if (commands[command] && !ANONYMOUS_COMMANDS.has(command) && !loadConfig().token) {
-  die('Not authenticated. Run: pulsar login <apiUrl>');
-}
+export {saveConfig, browserLogin};
+
+// Only dispatch when run as the CLI — importing the module (e.g. from tests) must not execute a command.
+if (import.meta.url === `file://${process.argv[1]}`) {
+  const [command, ...rest] = process.argv.slice(2);
+  const commands = {
+    login: cmdLogin,
+    apps: cmdApps,
+    release: cmdRelease,
+    'release-train': cmdReleaseTrain,
+    promote: cmdPromote,
+    rollback: cmdRollback,
+    deployment: cmdDeployment,
+    history: cmdHistory,
+    patch: cmdPatch,
+    keygen: cmdKeygen,
+    keys: cmdKeys,
+  };
 
-(commands[command] || (() => {
-  console.log('pulsar <login|apps|keys|release|release-train|promote|rollback|deployment|history|patch|keygen>');
-  process.exit(command ? 1 : 0);
-}))(rest);
+  const ANONYMOUS_COMMANDS = new Set(['login', 'keygen']);
+
+  if (commands[command] && !ANONYMOUS_COMMANDS.has(command) && !loadConfig().token) {
+    die('Not authenticated. Run: pulsar login <apiUrl>');
+  }
+
+  (commands[command] || (() => {
+    console.log('pulsar <login|apps|keys|release|release-train|promote|rollback|deployment|history|patch|keygen>');
+    process.exit(command ? 1 : 0);
+  }))(rest);
+}